### Install and Run Connector Service Commands

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/search-connectors/es-connectors-run-from-source.md

Commands to compile and start the connector service from the root of the cloned repository. Requires Python 3.10 or 3.11.

```shell
make install
make run
```

--------------------------------

### Setup and basic geo-distance aggregation

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/aggregations/search-aggregations-bucket-geodistance-aggregation.md

Requires a geo_point field mapping. This example creates an index, indexes museum locations, and runs a search with distance rings around Amsterdam.

```console
PUT /museums
{
  "mappings": {
    "properties": {
      "location": {
        "type": "geo_point"
      }
    }
  }
}

POST /museums/_bulk?refresh
{"index":{"_id":1}}
{"location": "POINT (4.912350 52.374081)", "name": "NEMO Science Museum"}
{"index":{"_id":2}}
{"location": "POINT (4.901618 52.369219)", "name": "Museum Het Rembrandthuis"}
{"index":{"_id":3}}
{"location": "POINT (4.914722 52.371667)", "name": "Nederlands Scheepvaartmuseum"}
{"index":{"_id":4}}
{"location": "POINT (4.405200 51.222900)", "name": "Letterenhuis"}
{"index":{"_id":5}}
{"location": "POINT (2.336389 48.861111)", "name": "Musée du Louvre"}
{"index":{"_id":6}}
{"location": "POINT (2.327000 48.860000)", "name": "Musée d'Orsay"}

POST /museums/_search?size=0
{
  "aggs": {
    "rings_around_amsterdam": {
      "geo_distance": {
        "field": "location",
        "origin": "POINT (4.894 52.3760)",
        "ranges": [
          { "to": 100000 },
          { "from": 100000, "to": 300000 },
          { "from": 300000 }
        ]
      }
    }
  }
}
```

--------------------------------

### Search Multiple Data Stream Failure Stores (YAML)

Source: https://github.com/elastic/elasticsearch/blob/main/docs/release-notes/index.md

These examples demonstrate various ways to search across multiple data stream failure stores using wildcard patterns and the `::failures` selector, including an ES|QL `FROM` clause.

```yaml
POST logs-*::failures/_search
```

```yaml
POST logs-*,logs-*::failures/_search
```

```yaml
POST *::failures/_search
```

```yaml
POST _query
{
  "query": "FROM my_data_stream*::failures"
}
```

--------------------------------

### Example EQL sample query for file and process events

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/eql/eql-syntax.md

This example returns up to 10 samples, each with unique `host` values, consisting of a file creation event followed by a process event.

```eql
sample by host
  [ file where file.extension == "exe" ]
  [ process where true ]
```

--------------------------------

### GET /_search (Wildcard Query)

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/query-dsl/query-dsl-wildcard-query.md

Searches for documents where a specified field contains terms matching a wildcard pattern. This example demonstrates searching for user IDs starting with 'ki' and ending with 'y'.

```APIDOC
## GET /_search

### Description
Returns documents that contain terms matching a wildcard pattern. This query uses wildcard operators (`*` for zero or more characters, `?` for a single character) to find matching terms within a specified field.

### Method
GET

### Endpoint
/_search

### Request Body
- **query** (object) - Required - The query definition.
  - **wildcard** (object) - Required - Defines the wildcard query.
    - **{field_name}** (object) - Required - The field you wish to search. Replace `{field_name}` with the actual field name (e.g., `user.id`).
      - **value** (string) - Required - Wildcard pattern for terms. Supports `*` and `?`.
      - **wildcard** (string) - Optional - An alias for `value`. If both are specified, the last one in the request body is used.
      - **boost** (float) - Optional - Floating point number to adjust relevance scores. Defaults to `1.0`.
      - **case_insensitive** (Boolean) - Optional - If `true`, allows case insensitive matching. Defaults to `false`. (Added in 7.10.0)
      - **rewrite** (string) - Optional - Method used to rewrite the query.

### Request Example
```json
{
  "query": {
    "wildcard": {
      "user.id": {
        "value": "ki*y",
        "boost": 1.0,
        "rewrite": "constant_score_blended"
      }
    }
  }
}
```

### Response
#### Success Response (200)
The response will contain search hits where the specified field's terms match the wildcard pattern. The exact structure depends on the Elasticsearch search response format.

#### Response Example
```json
{
  "took": 10,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 3,
      "relation": "eq"
    },
    "max_score": 1.0,
    "hits": [
      {
        "_index": "my_index",
        "_id": "1",
        "_score": 1.0,
        "_source": {
          "user": {
            "id": "kiy"
          }
        }
      },
      {
        "_index": "my_index",
        "_id": "2",
        "_score": 1.0,
        "_source": {
          "user": {
            "id": "kity"
          }
        }
      },
      {
        "_index": "my_index",
        "_id": "3",
        "_score": 1.0,
        "_source": {
          "user": {
            "id": "kimchy"
          }
        }
      }
    ]
  }
}
```
```

--------------------------------

### Start Elasticsearch Service (Shell)

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/elasticsearch-plugins/discovery-gce-usage-long.md

Command to start the Elasticsearch service after installing the plugin and configuring `elasticsearch.yml`.

```sh
sudo systemctl start elasticsearch
```

--------------------------------

### Setup index and data for terms aggregation

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/aggregations/search-aggregations-bucket-terms-aggregation.md

Creates a products index with keyword mappings and populates it with sample data for testing aggregations.

```console
PUT /products
{
  "mappings": {
    "properties": {
      "genre": {
        "type": "keyword"
      },
      "product": {
        "type": "keyword"
      }
    }
  }
}
POST /products/_bulk?refresh
{"index":{"_id":0}}
{"genre": "rock", "product": "Product A"}
{"index":{"_id":1}}
{"genre": "rock", "product": "Product B"}
{"index":{"_id":2}}
{"genre": "rock", "product": "Product C"}
{"index":{"_id":3}}
{"genre": "jazz", "product": "Product D"}
{"index":{"_id":4}}
{"genre": "jazz", "product": "Product E"}
{"index":{"_id":5}}
{"genre": "electronic", "product": "Anthology A"}
{"index":{"_id":6}}
{"genre": "electronic", "product": "Anthology A"}
{"index":{"_id":7}}
{"genre": "electronic", "product": "Product F"}
{"index":{"_id":8}}
{"genre": "electronic", "product": "Product G"}
{"index":{"_id":9}}
{"genre": "electronic", "product": "Product H"}
{"index":{"_id":10}}
{"genre": "electronic", "product": "Product I"}
```

--------------------------------

### ES|QL Numeric Literal - Decimal starting with point

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/esql/esql-syntax.md

An example of a decimal numeric literal starting with a decimal point.

```sql
.1234   -- decimal notation starting with decimal point
```

--------------------------------

### Create the cooking_blog index

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/esql/esql-search-tutorial.md

Initializes the index used for the tutorial examples.

```console
PUT /cooking_blog
```

--------------------------------

### Download Sample Configuration File

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/search-connectors/es-connectors-postgresql.md

Downloads the example configuration file for the connector service using curl. Remember to update the output path if needed.

```sh
curl https://raw.githubusercontent.com/elastic/connectors/main/app/connectors_service/config.yml.example --output ~/connectors-config/config.yml
```

--------------------------------

### SUBSTRING function syntax and example

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/sql/sql-functions-string.md

Extracts a substring from source starting at position start for length characters. Returns null if any parameter is null.

```sql
SUBSTRING(
    source, <1>
    start,  <2>
    length) <3>
```

```sql
SELECT SUBSTRING('Elasticsearch', 0, 7);

SUBSTRING('Elasticsearch', 0, 7)
--------------------------------
Elastic
```

--------------------------------

### Install ODBC Driver via Command Line

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/sql/sql-odbc-installation.md

Basic msiexec command to install the 64-bit ODBC driver with default settings. Use start /wait to ensure the process completes before returning control.

```batch
msiexec.exe /i esodbc-{{version.stack}}-windows-x86_64.msi /qn
```

```batch
start /wait msiexec.exe /i esodbc-{{version.stack}}-windows-x86_64.msi /qn
```

--------------------------------

### Create Index, Ingest Data, and Perform Geo-line Aggregation (Console)

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/aggregations/search-aggregations-metrics-geo-line.md

This example demonstrates how to set up an index with `geo_point` and `date` fields, ingest sample data, and then execute a `geo_line` aggregation to generate a LineString from the geo-points, sorted by timestamp.

```console
PUT test
{
    "mappings": {
        "properties": {
            "my_location": { "type": "geo_point" },
            "group":       { "type": "keyword" },
            "@timestamp":  { "type": "date" }
        }
    }
}

POST /test/_bulk?refresh
{"index":{}}
{"my_location": {"lat":52.373184, "lon":4.889187}, "@timestamp": "2023-01-02T09:00:00Z"}
{"index":{}}
{"my_location": {"lat":52.370159, "lon":4.885057}, "@timestamp": "2023-01-02T10:00:00Z"}
{"index":{}}
{"my_location": {"lat":52.369219, "lon":4.901618}, "@timestamp": "2023-01-02T13:00:00Z"}
{"index":{}}
{"my_location": {"lat":52.374081, "lon":4.912350}, "@timestamp": "2023-01-02T16:00:00Z"}
{"index":{}}
{"my_location": {"lat":52.371667, "lon":4.914722}, "@timestamp": "2023-01-03T12:00:00Z"}

POST /test/_search?filter_path=aggregations
{
  "aggs": {
    "line": {
      "geo_line": {
        "point": {"field": "my_location"},
        "sort":  {"field": "@timestamp"}
      }
    }
  }
}
```

--------------------------------

### Launching the SQL CLI with Connection Options

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/sql/sql-cli.md

Start the SQL CLI using the provided script. You can specify the server URL and include basic authentication credentials directly in the connection string.

```bash
$ ./bin/elasticsearch-sql-cli
```

```bash
$ ./bin/elasticsearch-sql-cli https://some.server:9200
```

```bash
$ ./bin/elasticsearch-sql-cli https://sql_user:strongpassword@some.server:9200
```

--------------------------------

### Text Expansion Query Example Request

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/query-dsl/query-dsl-text-expansion-query.md

This example demonstrates how to use the `text_expansion` query within a `GET _search` request. It specifies the target sparse vector field, the model ID, and the query text.

```console
GET _search
{
   "query":{
      "text_expansion":{
         "<sparse_vector_field>":{
            "model_id":"the model to produce the token weights",
            "model_text":"the query string"
         }
      }
   }
}
```

--------------------------------

### CLI list

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/elasticsearch/command-line-tools/elasticsearch-keystore.md

Lists all settings currently stored in the keystore.

```APIDOC
## CLI list

### Description
Lists the names of the settings currently stored in the keystore.

### Method
CLI

### Endpoint
bin/elasticsearch-keystore list

### Response
#### Success Response (200)
- **settings** (array) - A list of setting names.

### Response Example
keystore.seed
gcs.client.default.credentials_file
```

--------------------------------

### GET /test/_search - Rank Feature Query Example

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/query-dsl/query-dsl-rank-feature-query.md

This example demonstrates a `rank_feature` query that searches for '2016' and boosts relevance scores based on `pagerank`, `url_length`, and `topics.sports` fields using a boolean query.

```APIDOC
## GET /test/_search

### Description
Searches for '2016' and boosts relevance scores based on `pagerank`, `url_length`, and `topics.sports` fields.

### Method
GET

### Endpoint
/test/_search

### Request Body
- **query** (object) - Required - The query definition.
  - **bool** (object) - Required - Boolean query combining must and should clauses.
    - **must** (array) - Optional - Clauses that must match.
      - **match** (object) - Required - A match query.
        - **content** (string) - Required - The field to search, e.g., "2016".
    - **should** (array) - Optional - Clauses that should match to influence relevance.
      - **rank_feature** (object) - Required - Rank feature query for 'pagerank'.
        - **field** (string) - Required - The rank feature field, e.g., "pagerank".
      - **rank_feature** (object) - Required - Rank feature query for 'url_length'.
        - **field** (string) - Required - The rank feature field, e.g., "url_length".
        - **boost** (float) - Optional - Boost value, e.g., 0.1.
      - **rank_feature** (object) - Required - Rank feature query for 'topics.sports'.
        - **field** (string) - Required - The rank feature field, e.g., "topics.sports".
        - **boost** (float) - Optional - Boost value, e.g., 0.4.

### Request Example
```json
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "content": "2016"
          }
        }
      ],
      "should": [
        {
          "rank_feature": {
            "field": "pagerank"
          }
        },
        {
          "rank_feature": {
            "field": "url_length",
            "boost": 0.1
          }
        },
        {
          "rank_feature": {
            "field": "topics.sports",
            "boost": 0.4
          }
        }
      ]
    }
  }
}
```
```

--------------------------------

### Setup: Create Users and API Keys

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/elasticsearch/rest-apis/query-api-keys.md

This setup snippet creates two users, 'king' and 'june', and then grants several API keys to them with varying expiration settings. One API key for 'king' and one for 'june' are immediately deleted to demonstrate invalidation.

```console
POST /_security/user/king
{
  "password" : "security-test-password",
  "roles": []
}
POST /_security/user/june
{
  "password" : "security-test-password",
  "roles": []
}
POST /_security/api_key/grant
{
  "grant_type": "password",
  "username" : "king",
  "password" : "security-test-password",
  "api_key" : {
    "name": "king-key-no-expire"
  }
}
DELETE /_security/api_key
{
  "name" : "king-key-no-expire"
}
POST /_security/api_key/grant
{
  "grant_type": "password",
  "username" : "king",
  "password" : "security-test-password",
  "api_key" : {
    "name": "king-key-10",
    "expiration": "10d"
  }
}
POST /_security/api_key/grant
{
  "grant_type": "password",
  "username" : "king",
  "password" : "security-test-password",
  "api_key" : {
    "name": "king-key-100",
    "expiration": "100d"
  }
}
POST /_security/api_key/grant
{
  "grant_type": "password",
  "username" : "june",
  "password" : "security-test-password",
  "api_key" : {
    "name": "june-key-no-expire"
  }
}
POST /_security/api_key/grant
{
  "grant_type": "password",
  "username" : "june",
  "password" : "security-test-password",
  "api_key" : {
    "name": "june-key-10",
    "expiration": "10d"
  }
}
POST /_security/api_key/grant
{
  "grant_type": "password",
  "username" : "june",
  "password" : "security-test-password",
  "api_key" : {
    "name": "june-key-100",
    "expiration": "100d"
  }
}
DELETE /_security/api_key
{
  "name" : "june-key-100"
}
```

--------------------------------

### Configure mandatory plugins in elasticsearch.yml

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/elasticsearch-plugins/mandatory-plugins.md

Add the plugin.mandatory setting to ensure the node only starts if the specified plugins are installed.

```yaml
plugin.mandatory: analysis-icu,lang-js
```

--------------------------------

### Initialize index and sample data for rare terms

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/aggregations/search-aggregations-bucket-rare-terms-aggregation.md

Create a products index with keyword mappings and bulk index documents to demonstrate term frequency distribution.

```js
PUT /products
{
  "mappings": {
    "properties": {
      "genre": {
        "type": "keyword"
      },
      "product": {
        "type": "keyword"
      }
    }
  }
}
POST /products/_bulk?refresh
{"index":{"_id":0}}
{"genre": "rock", "product": "Product A"}
{"index":{"_id":1}}
{"genre": "rock"}
{"index":{"_id":2}}
{"genre": "rock"}
{"index":{"_id":3}}
{"genre": "jazz", "product": "Product Z"}
{"index":{"_id":4}}
{"genre": "jazz"}
{"index":{"_id":5}}
{"genre": "electronic"}
{"index":{"_id":6}}
{"genre": "electronic"}
{"index":{"_id":7}}
{"genre": "electronic"}
{"index":{"_id":8}}
{"genre": "electronic"}
{"index":{"_id":9}}
{"genre": "electronic"}
{"index":{"_id":10}}
{"genre": "swing"}
```

--------------------------------

### Verify ARM64 support after qemu installation

Source: https://github.com/elastic/elasticsearch/blob/main/distribution/docker/README.md

After running the qemu-user-static setup, verify that linux/arm64 and other platforms are now available in buildx.

```shell
$ docker buildx ls
NAME/NODE DRIVER/ENDPOINT STATUS  BUILDKIT PLATFORMS
default * docker
  default default         running 20.10.21 linux/amd64, linux/arm64, linux/riscv64, linux/ppc64le, linux/s390x, linux/386, linux/arm/v7, linux/arm/v6
```

--------------------------------

### Update async EQL search retention period

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/eql.md

Change the retention period of an existing async EQL search using the get API with the keep_alive parameter. The new retention period starts after the get request completes.

```console
GET /_eql/search/FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=?keep_alive=5d
```

--------------------------------

### Bulk index documents for size parameter example

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/aggregations/search-aggregations-metrics-top-metrics.md

Loads sample documents with numeric sort and metric fields to demonstrate the `size` parameter for retrieving multiple top documents.

```console
POST /test/_bulk?refresh
{"index": {}}
{"s": 1, "m": 3.1415}
{"index": {}}
{"s": 2, "m": 1.0}
{"index": {}}
{"s": 3, "m": 2.71828}
```

--------------------------------

### GET /_search (Date Range Query)

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/query-dsl/query-dsl-range-query.md

Example of using the range query with date fields and date math expressions.

```APIDOC
## GET /_search

### Description
Returns documents where a date field falls within a range defined by date math (e.g., 'now-1d/d').

### Method
GET

### Endpoint
/_search

### Parameters
#### Request Body
- **range** (object) - Required - The range query object.
- **timestamp** (object) - Required - The date field to filter.
- **gte** (string) - Optional - Greater than or equal to (supports date math).
- **lte** (string) - Optional - Less than or equal to (supports date math).

### Request Example
{
  "query": {
    "range": {
      "timestamp": {
        "gte": "now-1d/d",
        "lte": "now/d"
      }
    }
  }
}

### Response
#### Success Response (200)
- **hits** (object) - The search results matching the date range.

#### Response Example
{
  "hits": {
    "total": {
      "value": 5,
      "relation": "eq"
    },
    "hits": []
  }
}
```

--------------------------------

### Download Connector Sample Configuration

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/search-connectors/es-connectors-zoom.md

Use this command to download the example configuration file for the self-managed Zoom connector. Remember to adjust the output path if needed.

```sh
curl https://raw.githubusercontent.com/elastic/connectors/main/app/connectors_service/config.yml.example --output ~/connectors-config/config.yml
```

--------------------------------

### Get month name from a literal datetime (ESQL)

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/esql/functions-operators/date-time-functions/month_name.md

This example applies `MONTH_NAME` to an ISO 8601 literal datetime string.

```esql
SELECT MONTH_NAME('2023-01-15T10:00:00Z') AS month_name
```

--------------------------------

### Example ES|QL query in Console

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/esql/esql-getting-started.md

Demonstrates a basic ES|QL query using the FROM command to retrieve documents from the kibana_sample_data_logs index.

```txt
POST /_query?format=txt
{
  "query": """
FROM kibana_sample_data_logs
  """
}
```

--------------------------------

### Install plugin from local file system

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/elasticsearch-plugins/plugin-management-custom-url.md

Use the file protocol for local installations on Unix or Windows. Wrap paths with spaces in quotes and ensure the source is not in the node's plugins directory.

```shell
sudo bin/elasticsearch-plugin install file:///path/to/plugin.zip
```

```shell
bin\elasticsearch-plugin install file:///C:/path/to/plugin.zip
```

--------------------------------

### Configure GitLab connector for Dockerized environments

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/search-connectors/es-connectors-gitlab.md

Example configuration for connecting the service to a local Dockerized Elasticsearch and Kibana setup.

```yaml
# When connecting to your cloud deployment you should edit the host value
elasticsearch.host: http://host.docker.internal:9200
elasticsearch.api_key: <ELASTICSEARCH_API_KEY>

connectors:
  -
    connector_id: <CONNECTOR_ID_FROM_KIBANA>
    service_type: gitlab
    api_key: <CONNECTOR_API_KEY_FROM_KIBANA> # Optional. If not provided, the connector will use the elasticsearch.api_key instead
```

--------------------------------

### Create a snapshot repository for ILM

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/elasticsearch/index-lifecycle-actions/ilm-searchable-snapshot.md

Setup a filesystem-based snapshot repository required for storing searchable snapshots.

```console
PUT /_snapshot/backing_repo
{
 "type": "fs",
  "settings": {
    "location": "my_backup_location"
  }
}
```

--------------------------------

### STARTS_WITH function syntax and examples

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/sql/sql-functions-string.md

Returns true if source starts with pattern (case-sensitive). Both parameters return null if null is passed.

```sql
STARTS_WITH(
    source,   <1>
    pattern)  <2>
```

```sql
SELECT STARTS_WITH('Elasticsearch', 'Elastic');

STARTS_WITH('Elasticsearch', 'Elastic')
--------------------------------
true
```

```sql
SELECT STARTS_WITH('Elasticsearch', 'ELASTIC');

STARTS_WITH('Elasticsearch', 'ELASTIC')
--------------------------------
false
```

--------------------------------

### List All Tables

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/sql/sql-syntax-show-tables.md

Shows how to list all available tables using the basic `SHOW TABLES` command.

```sql
SHOW TABLES;

 catalog       |     name      | type     |     kind
---------------+---------------+----------+---------------
javaRestTest      |emp            |TABLE     |INDEX
javaRestTest      |employees      |VIEW      |ALIAS
javaRestTest      |library        |TABLE     |INDEX
```

--------------------------------

### Filter records using the LIKE operator

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/sql/sql-like-rlike-operators.md

Example of using the percent sign (%) wildcard to match strings starting with a specific prefix.

```sql
SELECT author, name FROM library WHERE name LIKE 'Dune%';
```

```text
    author     |     name
---------------+---------------
Frank Herbert  |Dune
Frank Herbert  |Dune Messiah
```

--------------------------------

### Command Line Usage

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/elasticsearch/command-line-tools/create-enrollment-token.md

Command-line examples for using the `elasticsearch-create-enrollment-token` tool.

```APIDOC
## Command Line Tool: elasticsearch-create-enrollment-token

### Description
Creates enrollment tokens for Elasticsearch nodes and Kibana instances.

### Synopsis
```shell
bin/elasticsearch-create-enrollment-token
[-f, --force] [-h, --help] [-E <KeyValuePair>] [-s, --scope] [--url]
```

### Parameters
#### Command Line Options
- **-E <KeyValuePair>** (string) - Configures a standard Elasticsearch or X-Pack setting.
- **-f, --force** (boolean) - Forces the command to run against an unhealthy cluster.
- **-h, --help** (boolean) - Returns all of the command parameters.
- **-s, --scope** (string) - Specifies the scope of the generated token. Supported values are `node` and `kibana`.
- **--url** (string) - Specifies the base URL (hostname and port of the local node) that the tool uses to submit API requests to Elasticsearch. The default value is determined from the settings in your `elasticsearch.yml` file. If `xpack.security.http.ssl.enabled` is set to `true`, you must specify an HTTPS URL.

### Examples
#### Example 1: Create an enrollment token for an Elasticsearch node
```shell
bin/elasticsearch-create-enrollment-token -s node
```

#### Example 2: Create an enrollment token for a Kibana instance
```shell
bin/elasticsearch-create-enrollment-token -s kibana --url "https://172.0.0.3:9200"
```
```

--------------------------------

### ES|QL Numeric Literal - Scientific Notation with Negative Sign

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/esql/esql-syntax.md

An example of a numeric literal in scientific notation starting with a negative sign.

```sql
-.1e2   -- scientific notation starting with the negative sign
```

--------------------------------

### PUT /fingerprint_example (Create Index with Fingerprint Analyzer)

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/text-analysis/analysis-fingerprint-tokenfilter.md

Shows how to configure a new custom analyzer using the `fingerprint` filter when creating an Elasticsearch index.

```APIDOC
## PUT /fingerprint_example

### Description
This API request creates a new Elasticsearch index named `fingerprint_example` and configures a custom analyzer that uses the `whitespace` tokenizer and the `fingerprint` token filter.

### Method
PUT

### Endpoint
/fingerprint_example

### Request Body
- **settings** (object) - Required - Index settings.
  - **analysis** (object) - Required - Analysis settings.
    - **analyzer** (object) - Required - Analyzer definitions.
      - **whitespace_fingerprint** (object) - Required - Definition for the custom analyzer.
        - **tokenizer** (string) - Required - The tokenizer to use, e.g., "whitespace".
        - **filter** (array of strings) - Required - An array of token filters to apply, e.g., ["fingerprint"].

### Request Example
{
  "settings": {
    "analysis": {
      "analyzer": {
        "whitespace_fingerprint": {
          "tokenizer": "whitespace",
          "filter": [ "fingerprint" ]
        }
      }
    }
  }
}

### Response
#### Success Response (200)
- **acknowledged** (boolean) - Indicates if the request was acknowledged by the cluster.
- **shards_acknowledged** (boolean) - Indicates if the shards were acknowledged.
- **index** (string) - The name of the created index.

#### Response Example
{
  "acknowledged": true,
  "shards_acknowledged": true,
  "index": "fingerprint_example"
}
```

--------------------------------

### ES|QL Quoted Identifier Example

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/esql/esql-syntax.md

Demonstrates how to quote identifiers that do not start with a letter, underscore, or '@', or contain special characters, using backticks.

```esql
FROM index
| KEEP `1.field`
```

--------------------------------

### Show binary keystore setting to file

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/elasticsearch/command-line-tools/elasticsearch-keystore.md

Displays a binary setting from the keystore and writes it to a file using the -o or --output option.

```sh
bin/elasticsearch-keystore show -o my_file binary.setting.name
```

--------------------------------

### GET /_search with Painless Filter Script

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/scripting-languages/painless/painless-filter-context.md

Example of using a Painless script in filter context to filter documents based on calculated field values. This example filters ecommerce orders where the average price per item exceeds a minimum threshold.

```APIDOC
## GET /_search

### Description
Execute a search query with a Painless filter script to include/exclude documents based on custom filtering logic.

### Method
GET

### Endpoint
/{index}/_search

### Request Body

#### query (object) - Required
- The query definition containing the filter with the Painless script

#### query.bool (object) - Optional
- Boolean query wrapper for combining multiple query clauses

#### query.bool.filter (object) - Optional
- Filter clause containing the script filter

#### query.bool.filter.script (object) - Required
- Script filter definition

#### query.bool.filter.script.script (object) - Required
- **source** (string) - Required - The Painless script source code
- **params** (object) - Optional - User-defined parameters passed to the script

### Request Example
```json
GET kibana_sample_data_ecommerce/_search
{
  "query": {
    "bool": {
      "filter": {
        "script": {
          "script": {
            "source": "(doc['taxful_total_price'].value / doc['total_quantity'].value) > params.min_avg_price",
            "params": {
              "min_avg_price": 30
            }
          }
        }
      }
    }
  }
}
```

### Response

#### Success Response (200)
- Returns matching documents where the filter script evaluated to true
- Documents are returned in the hits array
- Each document includes _index, _id, _score, and _source fields

### Notes
- Filter context answers "Does this document match?" with a yes/no response
- Use filter context for all conditions that do not require scoring
- The script in this example calculates average price per item and compares it to a threshold parameter
```

--------------------------------

### GET /_search (Has Parent with Sorting)

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/query-dsl/query-dsl-has-parent-query.md

Example of using has_parent with a function_score query to sort child documents based on a field in the parent document.

```APIDOC
## GET /_search

### Description
Since standard sorting is not supported for has_parent, this example uses function_score to sort child documents by a parent field (e.g., view_count).

### Method
GET

### Endpoint
/_search

### Parameters
#### Request Body
- **parent_type** (string) - Required - Name of the parent relationship.
- **score** (boolean) - Required - Must be set to true to aggregate the parent score for sorting.
- **query** (query object) - Required - A function_score query used to calculate the score based on parent fields.

### Request Example
{
  "query": {
    "has_parent": {
      "parent_type": "parent",
      "score": true,
      "query": {
        "function_score": {
          "script_score": {
            "script": "_score * doc['view_count'].value"
          }
        }
      }
    }
  }
}
```

--------------------------------

### View MSI Command Line Help

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/sql/sql-odbc-installation.md

Display available Windows Installer command-line arguments and options for msiexec.exe.

```batch
msiexec.exe /help
```

--------------------------------

### Create index and index document for shirts

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/elasticsearch/rest-apis/filter-search-results.md

Set up a shirts index with keyword mappings for brand, color, and model, then index a sample document.

```console
PUT /shirts
{
  "mappings": {
    "properties": {
      "brand": { "type": "keyword"},
      "color": { "type": "keyword"},
      "model": { "type": "keyword"}
    }
  }
}

PUT /shirts/_doc/1?refresh
{
  "brand": "gucci",
  "color": "red",
  "model": "slim"
}
```

--------------------------------

### Create Index with Standard Mode

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/elasticsearch/index-settings/index-modules.md

This example demonstrates how to create a new index and explicitly set its `index.mode` to `standard` within the settings block during index creation.

```console
PUT my-index-000001
{
  "settings": {
    "index":{
      "mode":"standard"
    }
  }
}
```

--------------------------------

### Extracting the first number from a multi-value field in ESQL

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/esql/functions-operators/mv-functions/mv_first.md

This example demonstrates using `MV_FIRST` to get the first value from the `numbers` multi-value field in `my_other_data`.

```esql
FROM my_other_data
| SELECT mv_first(numbers) AS first_number
```

--------------------------------

### Example config.yml with Multiple Connectors

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/search-connectors/es-connectors-run-from-source.md

Demonstrates how to configure multiple connectors with specific API keys or fallback to a global Elasticsearch API key.

```yaml
elasticsearch:
  api_key: <key1> # Used to write data to .elastic-connectors and .elastic-connectors-sync-jobs
                # Any connectors without a specific `api_key` value will default to using this key
connectors:
  - connector_id: 1234
    api_key: <key2> # Used to write data to the `search-*` index associated with connector 1234
                    # You may have multiple connectors in your config file!
  - connector_id: 5678
    api_key: <key3> # Used to write data to the `search-*` index associated with connector 5678
  - connector_id: abcd # No explicit api key specified, so this connector will use <key1>
```

--------------------------------

### Get help for elasticsearch-plugin CLI

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/elasticsearch-plugins/plugin-management.md

Run this command to view usage instructions for the plugin management tool. Ensure you have the correct permissions based on your installation type.

```bash
sudo bin/elasticsearch-plugin -h
```

--------------------------------

### POST /_slm/start

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/elasticsearch/rest-apis/index.md

Starts the snapshot lifecycle management feature. Use this endpoint to enable automatic snapshot scheduling.

```APIDOC
## POST /_slm/start

### Description
Starts the snapshot lifecycle management feature.

### Method
POST

### Endpoint
/_slm/start
```

--------------------------------

### Extracting Datetime Units with DATE_PART

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/sql/sql-functions-datetime.md

Examples of extracting year, minute, quarter, month, and week units. Note that 'week' uses a non-ISO calculation starting on Sunday.

```sql
SELECT DATE_PART('year', '2019-09-22T11:22:33.123Z'::datetime) AS "years";
```

```sql
SELECT DATE_PART('mi', '2019-09-04T11:22:33.123Z'::datetime) AS mins;
```

```sql
SELECT DATE_PART('quarters', CAST('2019-09-24' AS DATE)) AS quarter;
```

```sql
SELECT DATE_PART('month', CAST('2019-09-24' AS DATE)) AS month;
```

```sql
SELECT DATE_PART('week', '2019-09-22T11:22:33.123Z'::datetime) AS week;
```

--------------------------------

### Basic KQL query example

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/query-dsl/query-dsl-kql-query.md

Return s document s matching a specifi c servic e name an d HTTP statu s code using KQL syntax.

```console
GET /_search
{
  "query": {
    "kql": {
      "query": "service.name: \"checkout-service\" AN D http.response.status_code: 200"
    }
  }
}
```

--------------------------------

### GET /_search (Lat/Lon as String)

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/query-dsl/query-dsl-geo-bounding-box-query.md

Example demonstrating the `geo_bounding_box` filter where `top_left` and `bottom_right` coordinates are provided as strings in `lat,lon` or `POINT (lon lat)` format.

```APIDOC
## GET /{index}/_search (Lat/Lon as String)

### Description
Example demonstrating the `geo_bounding_box` filter where `top_left` and `bottom_right` coordinates are provided as strings in `lat,lon` or `POINT (lon lat)` format.

### Method
GET

### Endpoint
`/{index}/_search` (e.g., `/my_locations/_search`)

### Request Body
- **query** (object) - Required - The query definition.
  - **bool** (object) - Required - A boolean query clause.
    - **filter** (object) - Required - Filter clauses.
      - **geo_bounding_box** (object) - Required - The geo bounding box filter.
        - **{field_name}** (object) - Required - The geo field to filter on (e.g., `pin.location`).
          - **top_left** (string) - Required - The top-left corner as a string (e.g., `"POINT (-74.1 40.73)"` or `"40.73,-74.1"`).
          - **bottom_right** (string) - Required - The bottom-right corner as a string.

### Request Example
```json
{
  "query": {
    "bool": {
      "must": {
        "match_all": {}
      },
      "filter": {
        "geo_bounding_box": {
          "pin.location": {
            "top_left": "POINT (-74.1 40.73)",
            "bottom_right": "POINT (-71.12 40.01)"
          }
        }
      }
    }
  }
}
```
```

--------------------------------

### Setup index and data for significant terms analysis

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/aggregations/search-aggregations-bucket-significantterms-aggregation.md

Initialize the reports index with keyword fields and populate it with sample crime records for analysis.

```console
PUT /reports
{
  "mappings": {
    "properties": {
      "force": {
        "type": "keyword"
      },
      "crime_type": {
        "type": "keyword"
      }
    }
  }
}
POST /reports/_bulk?refresh
{"index":{"_id":0}}
{"force": "British Transport Police", "crime_type": "Bicycle theft"}
{"index":{"_id":1}}
{"force": "British Transport Police", "crime_type": "Bicycle theft"}
{"index":{"_id":2}}
{"force": "British Transport Police", "crime_type": "Bicycle theft"}
{"index":{"_id":3}}
{"force": "British Transport Police", "crime_type": "Robbery"}
{"index":{"_id":4}}
{"force": "Metropolitan Police Service", "crime_type": "Robbery"}
{"index":{"_id":5}}
{"force": "Metropolitan Police Service", "crime_type": "Bicycle theft"}
{"index":{"_id":6}}
{"force": "Metropolitan Police Service", "crime_type": "Robbery"}
{"index":{"_id":7}}
{"force": "Metropolitan Police Service", "crime_type": "Robbery"}
```

--------------------------------

### GET /_search (Lat/Lon as Array)

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/query-dsl/query-dsl-geo-bounding-box-query.md

Example demonstrating the `geo_bounding_box` filter where `top_left` and `bottom_right` coordinates are provided as arrays in `[lon, lat]` format, conforming to GeoJSON standards.

```APIDOC
## GET /{index}/_search (Lat/Lon as Array)

### Description
Example demonstrating the `geo_bounding_box` filter where `top_left` and `bottom_right` coordinates are provided as arrays in `[lon, lat]` format, conforming to GeoJSON standards.

### Method
GET

### Endpoint
`/{index}/_search` (e.g., `/my_locations/_search`)

### Request Body
- **query** (object) - Required - The query definition.
  - **bool** (object) - Required - A boolean query clause.
    - **filter** (object) - Required - Filter clauses.
      - **geo_bounding_box** (object) - Required - The geo bounding box filter.
        - **{field_name}** (object) - Required - The geo field to filter on (e.g., `pin.location`).
          - **top_left** (array) - Required - The top-left corner as `[lon, lat]`.
          - **bottom_right** (array) - Required - The bottom-right corner as `[lon, lat]`.

### Request Example
```json
{
  "query": {
    "bool": {
      "must": {
        "match_all": {}
      },
      "filter": {
        "geo_bounding_box": {
          "pin.location": {
            "top_left": [ -74.1, 40.73 ],
            "bottom_right": [ -71.12, 40.01 ]
          }
        }
      }
    }
  }
}
```
```

--------------------------------

### GET /_search (Lat/Lon as Properties)

Source: https://github.com/elastic/elasticsearch/blob/main/docs/reference/query-languages/query-dsl/query-dsl-geo-bounding-box-query.md

Example demonstrating the `geo_bounding_box` filter where `top_left` and `bottom_right` coordinates are provided as objects with `lat` and `lon` properties. This is a common and explicit format.

```APIDOC
## GET /{index}/_search (Lat/Lon as Properties)

### Description
Example demonstrating the `geo_bounding_box` filter where `top_left` and `bottom_right` coordinates are provided as objects with `lat` and `lon` properties. This is a common and explicit format.

### Method
GET

### Endpoint
`/{index}/_search` (e.g., `/my_locations/_search`)

### Request Body
- **query** (object) - Required - The query definition.
  - **bool** (object) - Required - A boolean query clause.
    - **filter** (object) - Required - Filter clauses.
      - **geo_bounding_box** (object) - Required - The geo bounding box filter.
        - **{field_name}** (object) - Required - The geo field to filter on (e.g., `pin.location`).
          - **top_left** (object) - Required - The top-left corner of the bounding box.
            - **lat** (number) - Required - Latitude of the top-left corner.
            - **lon** (number) - Required - Longitude of the top-left corner.
          - **bottom_right** (object) - Required - The bottom-right corner of the bounding box.
            - **lat** (number) - Required - Latitude of the bottom-right corner.
            - **lon** (number) - Required - Longitude of the bottom-right corner.

### Request Example
```json
{
  "query": {
    "bool": {
      "must": {
        "match_all": {}
      },
      "filter": {
        "geo_bounding_box": {
          "pin.location": {
            "top_left": {
              "lat": 40.73,
              "lon": -74.1
            },
            "bottom_right": {
              "lat": 40.01,
              "lon": -71.12
            }
          }
        }
      }
    }
  }
}
```
```